7

There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted.
Google's Chrome and Mozilla's FireFox bring their own lists of websites that are pinned to certain certificates. (Google calls an entry in this list "a pinset".)

How can I add certificate pinning for other domains to my web browser (e.g. FireFox)?

Is there a reason why there is no option to "Pin this certificate to this URI" when viewing the details of a certificate in a web browser? Would it undermine the concept of CAs, or is it just not implemented?

3

You can do it in Google Chrome with chrome://net-internals/#hsts :

In that screen you can consult the pinning state of a website (HSTS, HPKP and preloaded) but you can add certificate pinning for any domains too :

In the Add domain section, you can specify for any domain :

  • If you want to force HSTS
  • If you want to pin some certificate : you need to specify the list of public key fingerprints

Is there a reason why there is no option to "Pin this certificate to this URI" when viewing the details of a certificate in a web browser? Would it undermine the concept of CAs, or is it just not implemented?

Yes, there is one reason to make it difficult for users to pin a certificate : If the webmaster need to update his certificate, then he has no way to notify users. The browser will tell you that the key is not valid but you will have no way to decide if it's legitimate or not.

chrome net internals : hsts To do it, you mush export the certificate , then execute :

openssl x509 -in certificate.crt -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64

(replace "certificate.crt" with the name of the file you saved before)

You will get something like : YpcIku2YvZ9Q6rgTn8juPpBlEdzH7YFm9ZOLPImwwJk=

Then you fill "Public key fingerprints" field with sha256/YpcIku2YvZ9Q6rgTn8juPpBlEdzH7YFm9ZOLPImwwJk=

(note the sha256/ added in the beginning)

But if you want do it for more than one website, I strongly suggest to use an addon like Certificate Patrol for Firefox ( https://addons.mozilla.org/fr/firefox/addon/certificate-patrol/ ) as @WhiteWinterWolf suggested.

  • 1
    I suggest to elaborate, what it does and how. – peterh says reinstate Monica Jun 28 '15 at 12:45
  • @peterh : I've added some information. If more clarifications are needed, just ask. – Tom Jun 28 '15 at 15:50
  • One could elaborate how to convert the "Public key fingerprints" into the right format. I had some difficulties. Chrome wants the raw hex representation of it encoded in base64. One can use a specific web service for this like: tomeko.net/online_tools/hex_to_base64.php Or notepad++ with tricks/Plugins: Step one: Mark fingerprint -> Plugins -> Converter -> Hex to ASCII. (looks scrambled) Step two: Plugins -> MIME-Tools -> Base64 Encode. Readable text. notepad-plus-plus.org – nks Jul 1 '15 at 12:33
3

HPKP does not address this need.

HPKP is an extension to the HTTP protocol allowing website administrators to provide specific pining information to the browser, allowing:

  • To check that at least one of the certificate composing the authentication chain of the current HTTPS connection (depending on the platform architecture architecture, the server administrator may choose not to pin the final certificate but an intermediary or the root one instead),
  • Present an alternative Pin corresponding to backup certificate in case the primary one is lost/leaked/etc, so clients keep the ability to access the website after the certificate has been changed,
  • Tell the browser if the certificate pining should also be enable for sub-domains or not,
  • Tell the browser how long the pin is applicable in accordance with potential key migration schedule.

Would an HPKP set improperly, the browser will deny any access to the website without any direct recourse for the user. All the details above are mainly known and controlled by the server administrator, and not the final user, therefore the final user has no way to configure properly an HPKP pin in his browser.

What you may look for, instead, is for the browser to store some information concerning the certificates presented by non HPKP websites, and be able to alert you upon certificate change, up to the user then to check the new certificate and agree to continue if everything seems in order. Such feature already exists, at least on Firefox, but is handled by addons such as Certificate Patrol.

1

How can I add certificate pinning for other domains to my web browser (e.g. FireFox)?

I don't think it's got a GUI in Firefox. For Chrome see Tom's answer.

Is there a reason why there is no option to "Pin this certificate to this URI" when viewing the details of a certificate in a web browser?

Yes. It's support hell when it's time for a key rollover.

Would it undermine the concept of CAs, or is it just not implemented?

Both. And it's intentional. See above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.